Results 1 to 5 of 5

Thread: Just a loose idea for a tool.

Threaded View

  1. #1
    Naides is Nobody
    Join Date
    Jan 2002
    Planet Earth

    Just a loose idea for a tool.

    By no means this is a completely thought out thing,
    I would just like to listen ideas about how useful and how feasible a tool like this might be.

    When a protected program is installed, it introduces an arbitrary number of changes in the system: new files, new registry keys, hidden files, hidden records at low level hard disk locations, to keep track of time of install, number of uses, registered demo etc. etc.

    What I would like is a tool that produces an inventory of all these changes: At the time of installation, and at the time of 'demo expired' state.

    Of course Filemon and Regmon can keep track of many of these things, but with a lot of background noise, and necessarily running along the proctected app.

    What I would try goes like this:

    Set up a VMware virtual machine (Yes, I am fascinated with this toy).
    Clone it and install the Software in the clone.
    Clone it and expire the software.

    Now we have Static Snapshots of the three states, clean, active and expired.

    Scan the VMware .vmx files and pointout the differences:

    Of course scan means reversing the vmx internal structure, sorting out the disk logic structure, the file system structure and the windows registry structure.

    Because the analysis is done 'static', any antidebug, anti regmon anti filemon anti monitor tricks are effectively neutralized, no API hooking is necessary, the prtotection is NOT running, only its interactions with the machine are recorded.

    Last edited by naides; April 18th, 2005 at 08:09.

Similar Threads

  1. Turn that icon loose
    By mint77 in forum The Newbie Forum
    Replies: 4
    Last Post: February 7th, 2013, 23:11
  2. just an idea!!!
    By mike in forum Plugins (General)
    Replies: 5
    Last Post: February 25th, 2004, 10:21
  3. idea
    By HackeR MaN in forum Plugins (General)
    Replies: 2
    Last Post: February 16th, 2003, 12:32
  4. Just an idea ... let me know what you think
    By yaa in forum OllyDbg Support Forums
    Replies: 2
    Last Post: November 27th, 2002, 03:38


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts